FIN10
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.[1][2] |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.[1][2] |
| .003 | 命令与脚本解释器: Windows Command Shell |
FIN10 has executed malicious .bat files containing PowerShell commands.[1] |
||
| Enterprise | T1078 | 有效账户 |
FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.[1] |
|
| .003 | Local Accounts |
FIN10 has moved laterally using the Local Administrator account.[1] |
||
| Enterprise | T1570 | 横向工具传输 |
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.[1] |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
FIN10 has used batch scripts and scheduled tasks to delete critical system files.[1] |
| Enterprise | T1033 | 系统所有者/用户发现 |
FIN10 has used Meterpreter to enumerate users on remote systems.[1] |
|
| Enterprise | T1588 | .002 | 获取能力: Tool |
FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.[1] |
| Enterprise | T1021 | .001 | 远程服务: Remote Desktop Protocol |
FIN10 has used RDP to move laterally to systems in the victim environment.[1] |
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.[1][2] |